Log injection via unescaped geometry form values in Django
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19 are affected. The BaseGeometryWidget.deserialize() method used by GeometryField does not escape invalid submitted values before logging them, which is an improper neutralization of output for logs (CWE-117). A remote attacker can inject or forge log entries by submitting a crafted geometry value. Earlier, unsupported Django series were not evaluated and may also be affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| djangoproject | Django | 6.1 to before 6.1.3; 6.0 to before 6.0.10; 5.2 to before 5.2.19 | 6.1.3, 6.0.10, 5.2.19 | Patch available | CNA |
- Django Vendordjangoproject Affected 6.1 to before 6.1.3; 6.0 to before 6.0.10; 5.2 to before 5.2.19 Fixed in 6.1.3, 6.0.10, 5.2.19 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | — | — | djangoproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions — — ·djangoproject
Remediation
Upgrade Django to 6.1.3, 6.0.10, or 5.2.19, which fix the issue in their respective series.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Django (djangoproject) Fixed in 6.1.3, 6.0.10, 5.2.19
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
djangoproject Django — Django security releases issued: 6.1.3, 6.0.10, and 5.2.19
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-84393 Server-side request forgery in Django via SpatialReference string inputPriority LOW 37
- TI-2026-84390 Server-side request forgery via crs member of GeoJSON geometriesPriority LOW 37
- TI-2026-84388 Memory exhaustion in Django MultiPartParser via base64 file uploadsPriority LOW 37
Timeline
- 2026-11-03 Threatist record created from CVE-2026-111211
- 2026-11-03 CISA SSVC decision points changed
- 2026-11-03 Priority changed: MEDIUM → LOW
- 2026-11-03 Alias added: GHSA-cc89-hg86-h2hx
References
Patch 4
- https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba
- https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793
- https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374
- https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a
More djangoproject vulnerabilities
- TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-111211 · CVE Program
- CVE-2026-111211 · NVD
- FIRST EPSS
- GHSA-cc89-hg86-h2hx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences